CVE-2026-84258

UNKNOWN 0.0

click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.

Vendor	unknown
Product	click5 crm add-on to ninja forms
Published	Oct 11, 2026

Stay Ahead of the Next One

Get instant alerts for unknown click5 crm add-on to ninja forms

Be the first to know when new unknown vulnerabilities affecting unknown click5 crm add-on to ninja forms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / click5 CRM add-on to Ninja Forms

0 ≤ 1.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/3eae023f-a0fe-4313-9aee-18a8933eedb3/

Credits

Erwan LR (WPScan) WPScan